In the Claims 
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1. (Cancelled) 



2. (Currently amended) The computerized method of claim 4-3^ wherein the data structure 
is a directory entry for the file and the anti-virus state information is stored in at least one 
field in the directory entry. 



(Currently amended) The-Acomputerized method for fast virus scanning of a file ef 
claim 2, furth e r comprising: 

storing anti-virus state information in a data structure associated with the file and 
managed by a file system; 

partitioning the anti-virus state information into segments when storing the anti- 
virus state information in non-contiguous fields in the data structure , each segment being 
equal in size to one of a plurality of fields in the dir e ctory e ntr y data structure; and 

obtaining the anti-virus state information for the file from the data structure when 
the data structure has been retrieved by the file system . 

3- 

A? (Currently amended) The computerized method of claim 2, further comprising: 
creating the at least one field in the directory entry. 

4 / 

Jf. (Currently amended) The computerized method of claim -I3f 5 wherein the data structure 
is an extra file fork for the file. 

5 J 

J?. (Original) The computerized method of claim further comprising creating the extra 
file fork to hold the anti-virus state information. 

(p. I 

-7f (Currently amended) The computerized method of claim -J?3^wherein the data structure 
is stored as a resource within a resource fork for the file. 
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%. (Currently amended) The computerized method of claim %6 9 further comprising: 

encrypting the anti-virus state information before storing it in the data structure; 

and 

decrypting the anti-virus state information when it is obtained from the data 
structure. 



^9T(Currently amended) The computerized method of claim ^ further comprising: 
comparing the anti-virus state information stored in the data structure against 

corresponding information associated with a current version of the file to determine if 

virus scanning is required; and 

updating the anti-virus state information if the file is scanned as a result of the 

comparison. 



,^HT(Currently amended) The computerized method of claim i£ wherein data structure is 
retrieved by the file system as a result of the file being accessed by an application 
program. 



(Currently amended) The computerized method of claim i£ wherein data structure is 
retrieved by the file system as a result of a user requesting the file be scanned. 



^recurrently amended) The computerized method of claim wherein data structure is 
retrieved by the file system as a result of the file being in a pre-defined list of files 
scheduled for scanning. 



A3*. (Currently amended) A computer-readable medium having stored thereon executable 
instructions that cause a computer to execute a virus scanning method on a file, the 
method comprising: 

storing anti-virus state information for the file in a data structure associated with 
the file and managed by a file system; 
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partitioning the anti-virus state information into segments when storing the anti- 
vims state information in non-contiguous fields in the data structure, each segment being 
equal in size to one of a plurality of fields in the data structure; and 

obtaining the anti-virus state information for the file from the data structure when 
the data structure has been retrieved by the file system. 



yC. (Original) The computer-readable medium of claim ys, further comprising: 

encrypting the anti-virus state information before storing it in the data structure; 

and 

decrypting the anti-virus state information when it is obtained from the data 
structure. 

& ■■ & 

\o. (Original) The computer-readable medium of claim further comprising: 

comparing the anti-virus state information stored in the data structure against 

corresponding information associated with a current version of the file to determine if 

virus scanning is required; and 

updating the anti-virus state information if the file is scanned as a result of the 

comparison. 

IS. 12 

ISf (Currently amended) The computer-readable medium of claim yC wherein the data 
structure is a directory entry for the file and the anti-virus state information is stored in at 
least one field in the directory entry. 

(Original) The computer-readable medium of claim yf, wherein the data structure is 
an extra file fork for the file. 

-4#Tl(Original) The computer-readable medium of claim ^7f further comprising: 
creating the extra file fork to hold the anti-virus state information. 

1$. (Currently amended) A computer system comprising: 
a processor coupled to a system bus; 
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a memory coupled to the processor through the system bus; 

a computer-readable medium coupled to the processor through the system bus; 

a file system executed from the comput e r r e adabl e m e dium memory by the 
processor, wherein the file system causes the processor to store data structures associated 
with files on the computer-readable medium and further to retrieve the data structures 
from the computer-readable medium; and 

an anti-virus process executed from the comput e r r e adabl e m e dium memory by 
the processor, wherein the anti-virus process causes the processor to store anti-virus state 
information for the file in the data structure associated with the file , partition the anti- 
virus state information into segments when storing the anti-virus state information in non- 
contiguous fields in the data structure, each segment being equal in size to one of a 
plurality of fields in the data structure; and further to obtain the anti-virus state 
information for the file from the data structure when the data structure has been retrieved. 

& P 

20. (Currently amended) The computer system of claim 2©J#, wherein the anti-virus 
process further causes the processor to encrypt the anti-virus state information before 
storing it in the data structure and to decrypt the anti-virus state information when it is 
obtained from the data structure. 

Ad- J 

^r. (Currently amended) The computer system of claim 20 J# wherein the anti-virus 
process further causes the processor to compare the anti-virus state information stored in 
the data structure against corresponding information associated with a current version of 
the file to determine if virus scanning is required and to update the anti-virus state 
information if the anti-virus process causes the processor to scan the file as a result of the 
comparison. 

4 il 

(Currently amended) The computer system of claim 2Qj# wherein the data structure 
containing the anti-virus state information is an entry in a file system directory and the 
anti-virus process further causes the processor to store the anti-virus state information in 
the entry and to obtain the anti-virus state information from the entry. 
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Ifi. (Currently amended) The computer system of claim 2©ia wherein the data structure 
containing the anti-virus state information is an extra file fork for the file and the anti- 
virus process further causes the processor to store the anti-virus state information in the 
extra file fork and to obtain the anti-virus state information from the extra file fork. 

-2*T. (Currently amended) The computer system of claim 2423; wherein the anti-virus 
process further causes the processor to create the extra file fork to hold the anti-virus state 
information. 



^o. (Currently amended) The computer system of claim-20jy wherein the data structure 
containing the anti-virus state information is stored as a resource in a resource fork for the 
file and the anti-virus process further causes the processor to store the anti-virus state 
information in the resource fork and to obtain the anti-virus state information from the 
resource fork. 



J2?K (Currently amended) The-A^computer-readable medium of claim 27, having stored 
thereon a directory entry data structure for a file system comprising: 

a file identifier field containing data representing a file system identifier for a file 
wherein the file comprises a data fork and a resource fork; 

a first reserved field containing data representing an anti-virus state for the file 
identified by the file identifier field, the first r e s e rv e d fi e ld contains data representing a 
two-byte checksum for the file and data r e pr e s e nting two bytes of a three-byte length for 
the resource fork-^_and furth e r comprising: 

a second reserved field containing data representing a third byte for the resource 
fork length and data representing a three-byte length for the data fork. 






(Cancelled) 





(Cancelled) 
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